Uploaded image for project: 'Shiro'
  1. Shiro
  2. SHIRO-170

Force New Session ID on Authentication

    Details

      Description

      I am working on an application that has very high security standards. One of the issues raised after a full audit of the app is that it might be vulnerable for session fixation attacks. Shiro does not reset the Session ID after successful authentication, which would prevent this type of attack.

      IMHO this would add another level of security to Shiro beneficial for all kinds of applications.

      OWASP has a good page on session fixation attacks: http://www.owasp.org/index.php/Session_fixation

        Attachments

          Activity

            People

            • Assignee:
              Unassigned
              Reporter:
              ilikeorangutans Jakob Külzer
            • Votes:
              14 Vote for this issue
              Watchers:
              17 Start watching this issue

              Dates

              • Created:
                Updated: